requiring signed-in user to update profile
only requiring signed-in user to update his own profile